protect $HOME expansion; from das33@cornell.edu

diff --git a/lib/libc/gen/glob.c b/lib/libc/gen/glob.c
index 9f43dc3..057a173 100644 (file)
--- a/lib/libc/gen/glob.c
+++ b/lib/libc/gen/glob.c
@@ -35,7 +35,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: glob.c,v 1.2 1996/08/19 08:24:20 tholo Exp $";
+static char rcsid[] = "$OpenBSD: glob.c,v 1.3 1996/09/11 19:22:46 deraadt Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /*
@@ -355,7 +355,7 @@ globtilde(pattern, patbuf, pglob)
                 * handle a plain ~ or ~/ by expanding $HOME 
                 * first and then trying the password file
                 */
-               if ((h = getenv("HOME")) == NULL) {
+               if (issetugid() != 0 || (h = getenv("HOME")) == NULL) {
                        if ((pwd = getpwuid(getuid())) == NULL)
                                return pattern;
                        else